Getting Data In

Can you help me with a source type issue involving advanced parameters?

jip31
Motivator

Hello,

I need to create a source type from a log file in an attachment.
But, when I upload the file, I have a result like below:

x00-\x00+\x00+\x00-\x00 \x00C\x00:\x00

what is the problem please???

alt text

0 Karma

harsmarvania57
Ultra Champion

This is mostly due to character encoding. If you know that what type of character set is present in your log file then you can use CHARSET parameter in props.conf, more documentation http://docs.splunk.com/Documentation/Splunk/7.2.0/Data/Configurecharactersetencoding

0 Karma

ddrillic
Ultra Champion

You are most likely having the issue described at How do I remove \x00 characters from my log message?

I used the solution prescribed by @JSapienza in props.conf of the indexers and it worked perfectly fine -

SEDCMD-StripNULL= s/\x00//g

Please let us know.

0 Karma

jip31
Motivator

thanks but it doesnt work for me

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...